Welcome to our collaborative OT/ICS Resource List Repository. This space is dedicated to assembling a wide range of resources that cover everything from foundational learning materials to sophisticated tools and datasets for those involved in Operational Technology and Industrial Control Systems cybersecurity. By pooling knowledge from various sources, we aim to foster a learning and working environment that encourages sharing and growth. Each entry in this repository has been selected for its relevance and utility in addressing the unique challenges of OT cybersecurity. We invite you to explore, contribute, and help us keep this resource vibrant and current for the global cybersecurity community.
Collaboration based OT resource list, gathered through research and internet adventures.
The purpose of this wiki is basically to cover a large sprectrum of Cybersecurity for the OT field, from training to simple definitions of the technical knowledge.
If you are here to search for resources and mass information on different protocols and concepts, I advise you to go directly to the sections ICS ressource collection, ICS Lab Setup, and ICS news outlet.
The rest is just a compilation of my own research. If you are interested, an HTML bookmark file, usable on Firefox, is available.
-
- ICS challenge
- ICS CERT and CTI
- ICS OSINT
- ICS Ressource collections
- ICS Protocol , pcap and dataset
- ICS Security paper and conference
- ICS Firmware Tool And PLC Emulator
- ICS Lab Setup
- ICS Outlet, article , book and podcast
- Forum
- Hardware
- ISC security training
- ICS Law Requirement-guide and Standart
- ICS Vendor and equipement
- ICS Blue Team
- ICS Radio-Frequency
| Title | Description |
|---|---|
| Labtainer Lab Summary - Center for Cybersecurity and Cyber Operations - Naval Postgraduate School | Fully packaged Linux-based computer science lab exercises with an initial emphasis on cybersecurity. |
| SANS Dragos CTF 2023 Event | This free ICS CTF will feature multiple challenges focused on analyzing logic files, logs, network traffic, ICS protocols, digital forensic artifacts, and more to analyze attacks against an in-depth ICS range. |
| Play Now with BOTS Partner Experiences: Dragos Splunk | Helps you quickly prioritize, investigate, and respond to industrial threats which can also help compliance requirements across both IT and OT environments. |
| WRITE UP: Color Plant 1+2 (Misc) - FCSC2022 | (FR) A FCSC Challenge in 2022 about a web interface for monitoring the industrial system |
| Hack a Sat challenge | A fun challenge that bridges the cybersecurity aficionados and space program lovers |
| Red Alert ICS CTF | One of the ICS themed CTF of the DefCon conference |
| Biero el corridor brutal tank challenge | Challenge created for cyberdefender , you can play it localy via this repository |
| Hackropol ICS related challenge | Hackropole and the FCSC database, here are all the challenges related to the industrial control system that the FCSC has proposed since its creation. |
| Ace Responder ICS challenge: under pressure | Ace Responder is a blue team training platform, this is their OCS related DFIR challenge. |
| DFRWS 2023 Challenge on Industrial Control System Forensics | |
| github repository for the the above link | DFRWS 2023 Challenge on Industrial Control System Forensics github repos |
| SAFE Lab DFRWS Challenge | Interactive website companion for the DFRWS 2023 ICS forensics challenge with detailed scenario context. |
| Title | Description |
|---|---|
| Dragos 2018 repport | Dragos is a ICS CTI compagnie , every year theyr make a repport, this is for the year 2023 |
| Dragos 2023 repport | Dragos is a ICS CTI compagnie , every year theyr make a repport, this is for the year 2023 |
| Dragos 2024 repport | Dragos is a ICS CTI compagnie , every year theyr make a repport, this is for the year 2024 |
| Claroty IOControl repport | claroty analyse of IOcontrol mallware |
| Mandiant sandworm article | Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology |
| CISA Report CCP APT TTP's on ICS | People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection |
| ICS threath inteligence manual | Industrial Control Threat Intelligence |
| waterfall security 2025 OT Cyber Security Threat Report | waterfall security 2025 OT Cyber Security Threat Report |
| Mandiant sandworm report | Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology |
| IOC/TTP on China-nexus campain | IOC&TTP - China-Nexus Nation State Actors Exploit SAP NetWeaver |
| Report on China-nexus actions | China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures |
| COSMICENERGY OT Malware Analysis | Mandiant analysis of COSMICENERGY, a novel OT malware potentially linked to Russian emergency response exercises targeting IEC 60870-5-104 devices. |
| JA4+ Fingerprint Database | Community-maintained network fingerprint repository useful for identifying and fingerprinting ICS/OT network traffic. |
| SANS State of ICS/OT Security 2025 | Annual SANS survey report on the state of ICS/OT cybersecurity practices and trends. |
| Black Industry: IRGC-Linked Offensive OT Framework | Lab52 report on an IRGC-linked offensive OT framework targeting industrial control systems. |
| Title | Description |
|---|---|
| CERT Siemens | Siemens ProductCERT and Siemens CERT |
| CERT ABB Group | ABB CERT and alert services |
| CERT Schneider | Cybersecurity support portal of Schneider CERT |
| Dragos CVE disclosure | Dragos CVE Discosure |
| Title | Description |
|---|---|
| Hunto IP browser | Chinese Shodan-like IP browser |
| FOFA IP brower | Little browser of Shodan |
| Shodan | Best search engine for IoT I guess |
| Zoomeye | Best IP search engine on the east side of the world |
| Censys | Yet Another Shodan browser-like |
| Onyphe | French shodan like , that is really interesting |
| quanxin | Chniese IP Browser |
| Shodan wreapper | shodan api wrapper with dns record direclty show |
| Shadowservers world map of OT equipment 1 | Show the world statistics of IoT devices per country |
| Title | Description |
|---|---|
| API base cli search for zoomeye | Cyberspace Search auxiliary tool |
| API base cli search for FOFA | Search engine for mapping the cyberspace |
| API base cli search for IP browser | (CH) Information collection tool for GUI interface developed by the official api of cyberspace search engine |
| API base cli search for shodan and other | Python framework to automatically discover and enumerate hosts from different back-end systems (Shodan, Censys) |
| Title | Description |
|---|---|
| Honeydet conpot simens signature | honeydet is a signature based honeypot detector tool written in Golang |
| Honeypot Cyber deceptions based paper | Honeypot and cyber deception as a tool for detecting cyber attacks on critical infrastructure |
| ICSRANK | Query for search ICS equipent on public ip browser |
| biero-el-corridor honepot detections nuclei template | template to uwe with nuclei to detec defined honeypot (snap7 & Ethnernet/IP_CIP base) |
| ICS Honeypot System (CamouflageNet) Based on Attacker's Human Factors - ScienceDirect | ICS Honeypot System (2015) |
| Detection of critical infrastructure devices on the public Internet | TU Delft research paper on detecting critical infrastructure devices exposed on the public Internet. |
| Nuclei template for CPS and honeypot detections (article) | Medium article explaining the approach and design of nuclei templates for detecting ICS honeypots and cyber-physical systems. |
| Title | Description |
|---|---|
| Resource collections for beginners | Security-oriented list of resources about industrial network protocols |
| ICSCSI - Library of Resources for Industrial Control System Cyber Security | Library of Resources for Industrial Control System Cyber Security |
| MITRE ICS matrix | TTP MITRE matrix schemes for ICS |
| Orange-Cyberdefense/awesome-industrial-protocols | Compilation of industrial network protocols resources focusing on offensive security |
| Github star ressource list on ICS | Github ressource list of star from berensn |
| MrM8BRH GitHub user resource list | A smaller version of this github, but not made by myself |
| Biero OT/ICS Resource list | Refresh button, but I had to put it there at some point. |
| Industrial Automation Abbreviation Acronyms – PLC Tutorial Point | Wiki of abbreviations - good if, like myself, you hate acronyms because it goes messy if you're versatile |
| Major PLC manufacturers and PLC Software's List – PLC Tutorial Point | List of the major PLC manufacturers & softwares |
| Arabic Automation Courses Collection | Curated list of important automation and PLC courses and resources (Arabic). |
| Title | Description |
|---|---|
| IEC 61131-3 - Wikipedia | International Standard for programmmable logic controllers - Main focus here on PLCs (Feel free to check out the other IECs) |
| TCF - Eclipsepedia | Target Communication Framework Documentation |
| ascolab GmbH | Lab for industrial communication documentation |
| Wireshark Foundation / wireshark · GitLab | Come on guys, do we have to tell you what is wireshark ? Haha |
| BACnet stack - open source BACnet protocol stack | BACnet app layer, network layer and MAC layer communication services |
| Official page for programming parameters of snap 7 on the LOGO! 8 | Documentation for LOGO! implementation settings |
| Allen-Bradley Reference Manual for Ethernet | Allen-Bradley Reference Manual for Ethernet |
| Current list of all used apps with OPC UA compliance | OPC Servers, clients, toolkits and services from members of the OPC Foundation |
| PLC4X S7 Protocol Documentation | Apache PLC4X project documentation for the Siemens S7 protocol, useful for understanding S7 communication internals. |
| OpenPLC DNP3 Outstation Reference | Reference documentation for configuring and using the DNP3 outstation feature in OpenPLC. |
| BACnet Stack GitHub Organization | GitHub organization hosting various open-source BACnet protocol stack implementations. |
| c104 - IEC 60870-5-104 Python Library | Python library for IEC 60870-5-104 protocol communication, useful for testing and simulating ICS environments. |
| BACnet communication with PLC and SCADA - Pentotest | Article explaining BACnet protocol communication between PLCs and SCADA systems with practical examples. |
| DALI Lighting Protocol | Technical deep-dive into the DALI (Digital Addressable Lighting Interface) protocol used in building automation. |
| Title | Description |
|---|---|
| Modbus basic Functions code dcumentation | Modbus basic Functions code dcumentation |
| BACnet Vendor ID | BACnet offical Assigned Vendor IDs |
| BACnet MS/TP Capture Tool Documentation | Documentation for the BACnet MS/TP packet capture tool from the bacnet-stack project. |
| Siemens LOGO! Parameter VM Mapping | Siemens support page for parameter VM mapping on LOGO! 0BA7 and later devices. |
| Title | Description |
|---|---|
| PCAP Archive ICS Defense | Collection of PCAPs for ICS Defense |
| Traffic captures between STEP7 WinCC and S7-300/S7-400 PLCs | Some Snap7-PCAPs for clients applications, s7-300 and s7-400 series PLCs from a pretty cool dude |
| Cloudshark modbus bcap | online pcap containng modbus and ICP protocol |
| Pcap collections from netresec | Pcap collections from netresec, the guy who make and maintain networkminer |
| Digital Bond S4 Conference CTF PCAP Files | ICS-focused packet captures from the Digital Bond S4 conference capture-the-flag events. |
| Title | Description |
|---|---|
| OPC UA DARASET | Dataset to "Easing the Conscience with OPC UA: An Internet-Wide Study on Insecure Deployments" |
| Electra dataset, aggregations of multiple big PCAP | Anomaly detection ICS dataset from Electra dataset |
| OPC UA DATASET | The OPC UA CSV source file can be downloaded here. You can also find it in the IEEE DataPort.The generation of the dataset containing OPC UA traffic was possible due to the setup and execution of a laboratory CPPS testbed. This CPPS uses OPC UA standard for horizontal and vertical communications. Regarding the CPPS testbed setup, it consists on seven nodes in the network, as represented in the next Figure. |
| Title | Description |
|---|---|
| The Spear To Break The Security Wall Of S7CommPlus | Exploit Explanation of S7CommPlus and some security measures to counter it |
| Europe's 2022 Energy Sector: the Cyber Threats landscape - Citalid | Cyber threat Landscape of 2022 for the Energy Sector |
| SANS ICS Security - Control Systems Are a Target.pdf | 3-slide presentation of SANS on ICS/SCADA Security. Pretty cool for education. |
| Principles of Information Security, 5th ed. - Principles of Information Security (PDFDrive) | [Down for the moment - Use to be a bible of Cybersec] |
| Industrial Control System Security - Top 10 Threats and Countermeasures 2016 | BSI publication on OWASP Top 10 like but for ICS Security (2019) |
| CCE-Phase-1-4-Reference-Document.pdf | [Down for the moment] |
| DEF CON 26 - Thiago Alves - Hacking PLCs and Causing Havoc on Critical Infrastructures - YouTube | 40mn-conference on Hacking PLCs with OpenPLC |
| Reverse of a Schneider network protocol by Biero Llagas - Medium | A medium article on the UMAS schneider compliant protocol from a pretty cool dude |
| Grehack - Paper - Industrial Control Systems Dynamic Code Injection.pdf | [Down for the moment - Used to be a write-up on a ICS chall] |
| AMNESIA:33 How TCP/IP Stacks Breed Critical Vulnerabilities in IoT, OT and IT Devices | AMNESIA is a study of the Project Memoria on the results of the security analysis of seven open source TCP/IP stacks and a bundle of 33 vulnerabilities used on major IoT, OT and IT device vendors |
| VIRTUAL PLC PLATFORM FOR SECURITY AND FORENSICS OF INDUSTRIAL CONTROL SYSTEMS | 2023 research paper on virtual PLC platform for security and forensics of industrial control systems |
| Towards High-Interaction Virtual ICS Honeypots-in-a-Box | Research Paper on the design of virtual, high-interaction and server-based ICS honeypot and the deployment of a realistic, cost-effectibe and maintainable ICS honeypots. |
| Pwn2Own Miami 2022: OPC UA .NET Standard Trusted Application Check Bypass | 1st part of a series of write-up about ICS vulnerabilities. This one is about the Trusted Application Check Bypass in the OPC UA .NET Standard (CVE-2022-29865) |
| Siemens Trust Center PKI | Documentation on the Siemens Certification Authority Hierarchy of 2020 |
| HTB ICS network segmentation | Learn about the Purdue Model of ICS network segmentation from Hack The Box's ICS expert Barry "8balla" Murrell. |
| CVE-2019-12480 article releated | article on how they have discover the vulnerability (spoiler by fuzzing) |
| Article by forescout | Clearing the Fog of War – A critical analysis of recent energy sector cyberattacks in Denmark and Ukraine |
| Paper on PLC attack detections and forensic | A Survey on Programmable Logic Controller Vulnerabilities, Attacks, Detections, and Forensics |
| Compromising Industrial Processes using Web-Based Programmable Logic Controller Malware | 2024 Research Paper on how to compromise industrial processes using Web-based PLC Malware |
| CWE Industrial Control System and Operational Technology Special Interest Group | While IT has an extant body of work related to identifying and classifying security weaknesses, IT and ICS/OT are different, and existing IT classifications are not always useful in describing and managing security weaknesses in ICS/OT systems. Addressing this gap will help all stakeholders communicate more efficiently and effectively and promote a unity of effort in identifying and mitigating ICS/OT security weaknesses, especially in critical infrastructure. |
| Unpacking the Blackjack Group's Fuxnet Malware | Unpacking the Blackjack Group's Fuxnet Malware Ukrenian state sponsor attacking russian PLC |
| bsides-ics-ot-tampa | Bside conference specialised in ICS/OT security |
| Read description | securing operational technology:a deep dive into the water sectorhearingbefore thesubcommittee on cybersecurity and infrastructure protectionone hundred eighteenth congress |
| From Pass-the-Hash to Code Execution on Schneider Electric M340 PLCs | Black hat 2024: From Pass-the-Hash to Code Execution on Schneider Electric M340 PLCs |
| Exploring URGENT/11 Vulnerabilitie | Exploring and Exploiting Programmable Logic Controllers with URGENT/11 Vulnerabilitie |
| Armis report on VxWorks exploit used by Schneider & Rockwell | Exploring and Exploiting Programmable Logic Controllers with URGENT/11 Vulnerabilities |
| Fuzzing_ICS_protocols | Great article the express the aproach of the writer to fuzze BACNet and modbus protocol |
| Slide : Attacking and Defending Mission Critical ICS Assets | From Don C. Weber – SANS Certified Instructor and Author |
| DEF CON 15 - Unraveling SCADA Protocols Using Sulley Fuzzer | DEF CON 15 talk by Ganesh Devarajan on reverse engineering SCADA protocols using the Sulley fuzzing framework. |
| Enhancing Suricata IDS for SCADA Network Security | Research paper on enhancing the Suricata intrusion detection system for improved cyber security monitoring in SCADA networks. |
| ICS Honeypot System (CamouflageNet) Based on Attacker's Human Factors | 2015 research paper on designing ICS honeypots that account for attacker human factors and behavior. |
| Title | Description |
|---|---|
| FUXA | Web-based Process Visualization (SCADA/HMI/Dashboard) software |
| ScadaBR - Portuguese | SCADA system with applications in Process Control and Automation (opensource) (portuguese version) |
| ScadaBR - French | SCADA system with applications in Process Control and Automation (opensource) (french version) |
| ScadaBR - English | SCADA system with applications in Process Control and Automation (opensource) (english version) |
| ICSpector | Microsoft's ICS Forensics Framework for analyzing PLC metadata and project files. Useful for incident response and forensic investigations. |
| ICS Development Kits. | Downloadable SDK for multiple Protocol (very cool) |
| OPC UA SDKs - Traeger | Dedicated OPC UA development kits and SDKs for building OPC UA clients and servers. |
| PROVIEW - Open Source Control System | Free and open-source complete control system software for process automation and PLC-like functionality. |
| RS485 Sniffer | Tutorial and project for building an RS485 bus sniffer, useful for monitoring Modbus RTU and other serial ICS protocols. |
| Title | Description |
|---|---|
| NetToPLCSim download SourceForge.net | TCP/IP-Network extension for the PLC simulation software Siemens PLCSim (Step 7 V5.4/5.5) |
| MHJ-Software EN - comdrvs7 | All-in-one communication Library for S7-PLCs |
| DNP3 OPC Server Configuration Guide | Everything's in the title |
| IOServer - Interface to multiple protocols through a single OPC Server | Software allowing OPC clients such as HMI and SCADA systems to exchange plant floor data with PLCs |
| OpenPLC V3 - Docker Image Docker Hub | A Docker Image based on Ubuntu 18.04 for the OpenPLC Server |
| HoneyPLC: High-interaction Honeypot for PLCs and Industrial Control Systems | Github repository of HoneyPLC, designed to simulate multiple PLC models from different vendors |
| Parallel DNP3 slave simulator | Github repository for DNP3 Slave Simulator. Designed to be used for integration and performance testing of frent-end applications. |
| DNP3, MODBUS, OPC Client & Server Simulator | Link for Free Trial Version – Everything's in the title |
| OpenPLC Server - Docker Image Docker Hub | Docker containers for openplc server and editor |
| The World's Most Popular Allen-Bradley PLC Simulator | A stand-alone PLC training system without the expense of a PLC |
| Modifier Conpot of multiple ICS protocols | Modifier Conpots on dockerhub - with docker images from 2021, with 15 repositories |
| snap7 dockerfile | Docker containing S7-comm protocol capabilities via snap7 lib |
| Rapid SCADA website | Rapid SCADA is an open source industrial automation platform. The out of the box software provides tools for rapid creation of monitoring and control systems. In case of large implementation, Rapid SCADA is used as a core for development of custom SCADA and MES solutions for a Customer. |
| EcoStruxure Control Expert V15.3 installation file. | Free trialversion of EcoStruxure Control Expert |
| EcoStruxure Control Expert V16.0 installation file | Latest free trial version of Schneider Electric EcoStruxure Control Expert for Modicon PLC programming. |
| Title | Description |
|---|---|
| Siemens LOGO! firware archive | Siemens LOGO! firware archive |
| Siemens LOGO firmware download page | siemens website , siemens LOGO PLC firmware download page |
| Title | Description |
|---|---|
| Power_Grid_Simulation_System_Document | The Mini OT Power Grid Simulation System is a digital equivalent software platform designed to simulate the core operations of a hybrid power grid system, including hybrid power generation (natural gas power plants, solar power plants, and wind turbine farms), high-voltage power transmission and a three-level step-down power distribution system. The simulation integrates a SCADA system that incorporates PLCs for remote system control, RTUs and MUs for real-time data monitoring, and an HMI interface for operators to manage the grid. |
| LiuYuancheng Hight interactions Honeypot | This project aims to develop a sophisticated honeypot system that emulates an OT (Operational Technology) SCADA network environment, bridging Level 1 OT field controller devices. |
| How to connect Open PLC with Factory I/O - YouTube | A 20mn video tutorial on how to connect OpenPLC with Factory I/O |
| Virtual Industrial Cybersecurity Lab archivos - Rodrigo Cantera | A tutorial on how to develop and implement a TCP sequence prediction attack to inject malicious Modbus TCP packets with Scapy |
| How to set up an OT analysis lab. by biero llagas Medium | A Medium article on how to set up an OT analysis lab on the S7comm protocol made by a cool dude |
| stunnel | Stunnel is a proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs' code. |
| ICS PCAP Viz | A packet capture visualizer designed for industrial control networks, assisting in network traffic analysis and anomaly detection. |
| Python Virtual PLC Simulator with IEC-60870-5-104 Communication Protocol | self explanatory |
| Simulating Simple Railway Station Train Dock and Depart Auto-Control System with IEC104 PLC Simulator | self explanatory |
| Lab setup of a Schenider electric ecosystem | Lab setup |
| RS485 modbus rtu lab creations | exploit modbus rtu with a flipper zero , and learn how to setup the environement |
| First part of a serie covering the instalations of malcolm ICS | go haed this serie wiil cover setup and fine tune macolm ics with suricata rule ans adversary emulations |
| Wireshark for Modbus RTU - ABB Technical Note | ABB technical note on using Wireshark to capture and analyze Modbus RTU serial traffic. |
| BACnet/MS-TP Lab Guide | Hands-on lab guide for setting up and working with BACnet MS/TP protocol in a building automation training environment. |
| Title | Description |
|---|---|
| Scadafence blog panel | A SCADA-focused defence blog. Very interesting, I recommend it. |
| The Only SCADAhacker blog | A blog that provides a single point of contact for a wide range of readers covering multiple industry segments for quitely everything related to industrial security |
| Ruscadasec telegram | Russian SCADA news telegram |
| Iranian ICS news telegram | Iranian/Persian telegram ICS-related news |
| Article about offensive onsint on OT equipement? | Offensive OSINT s01e04 - Intelligence gathering on critical infrastructure in Southeast Asia |
| Offensive OSINT blog news | From the creator of KAMERKA |
| Good old Hackernews | Well, it's Good'ol Hackernews mi friend ! |
| Securityweek news OT/ICS sections | Securityweek news OT/ICS sections |
| Security affair | Nothing related to your supervisory officer having extramarital activities, it's a Threat Intelligence source of information |
| Japanese cyber ICS/OT news | Threat Intel source of info, but it's japanese |
| FBI Internet Crime Complaint Center (IC3) | Everything's in the title |
| Centralised podcast themed ICS | A list of ICS themed podcast |
| Industrial Cyber news outlet | Centralised info about vendor news and other articles on ICS and OT |
| ICS and OT related conferences | ICS and OT related conferences |
| Title | Description |
|---|---|
| OPC UA Deep Dive: A Complete Guide to the OPC UA Attack Surface - Claroty | A 10-step article on the OPC UA Attack SUrface |
| Evil PLC Attack: Weaponizing PLCs - Claroty | Team82 white paper on Evil PLC Attack |
| Siemens simatic exploit article | Experts found undocumented access feature in Siemens SIMATIC PLCs |
| Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology | A 09-2023 article by Mandiant about the Sandworm disrupt power in Ukraine. Threat Intelligence is great, Mandiant does it better. |
| Russian RE Modicon PLC | Some Russian who reverse-engineered the Modicon PLC from Schneider |
| Assessing the BACnet Control System Vulnerability - Dragos | A 3mn-read article by Dragos on how to assess the BACnet Control System Vulnerability |
| Article about offensive onsint on OT equipement | Offensive OSINT s01e04 - Intelligence gathering on critical infrastructure in Southeast Asia |
| Nozomi Hour november 2023 | Nozomi Hour is usually a 40mn video of the Threat Landscape, posted each semester. Feel free to update yourselves with these links, it's a great source of info for your cyberwatch. |
| OT Hunt: Finding ICS/OT with ZoomEye | Article on ZoomEye and how to use it. It's not that incredible article but it can help |
| Water management system hack | 2 municipal water facilities report falling to hackers in separate breaches |
| widely used modems in industrial iot devices open to sms attack | widely used modems in industrial iot devices open to sms attack |
| KNX protocol base locker attack summary | KNXlock – an attack campaign against KNX-based building automation systems |
| mySCADA myPRO Manager RCE Vulnerabilities | Prodaft analysis of critical remote code execution vulnerabilities found in mySCADA myPRO Manager and Runtime. |
| Kaspersky report on first-stage implants in industrial environments | Kaspersky ICS CERT report on first-stage implants used for persistent remote access across industrial organizations. |
| Title | Description |
|---|---|
| ISC security monitoring from Packt (second edition) | ICS security from Packt written by Pascal Ackerman, second edition |
| ICS field book | Basic but useful stuff on Industrial Security |
| Industrial Network Security : Securing critical infrastructure network | The best book you can find yet (from personal experience) |
| SCADA for Relay Technicians | 2019 book for SCADA beginners |
| Cybersécurité des systèmes industriels par Jean-Marie Flaus | French book on the ICS system |
| The Industrial Control System Cyber Kill Chain | The Industrial Control System Cyber Kill Chain writen in October 2015 by SANS |
| The ICS Cybersecurity Field Manual: VOL. 1-3 | The ICS Cybersecurity Field Manual: VOL. 1-3 Plus EXCLUSIVE BONUS material |
| PLC Handbook - AutomationDirect | Free comprehensive PLC handbook covering fundamentals, programming, and applications from AutomationDirect. |
| Scanning Highly Sensitive Networks | Guide on techniques and considerations for scanning highly sensitive OT/ICS networks without disrupting operations. |
| Title | Description |
|---|---|
| beerisac | A curated playlist of Operational Technology and ICS Cyber Security related podcast episodes [any language] by ICS Security enthusiasts. |
| Unsolicited Response | Podcast of Dale Peterson about ICS security |
| The Industrial Security Podcast |
| Title | Description |
|---|---|
| International PLC Forum | International PLC Forum |
| MrPLC Community Forum | Community forum for PLC programmers and automation professionals covering multiple PLC brands and protocols. |
| Title | Description |
|---|---|
| Online Circuit Emulator | A visualization of how electronic circuits are working |
| IC Logos Elnec | Programmable IC Logos |
| An Affordable And Programmable PLC Hackaday | A review of an Affordable and Programmable PLC |
| TechInfoDepot Wiki | Wikipedia for Hardware, but it's not wikipedia |
| OFRAK - Binary Analysis and Modification | Open-source tool for unpacking, modifying, and repacking firmware binaries, useful for ICS firmware analysis. |
| Title | Description |
|---|---|
| #01 - Identifying Components - Hardware Hacking Tutorial | A 15mn-tutorial video on youtube if you're looking for a very good introduction to hardware hacking |
| Make Me Hack - A hardware reverse youtube channel | Everything related to Hardware Hacking and Reverse Engineering including tutorials for beginners and more advanced stuff |
| Smiirl counter firmware dump | Gist on how to dump firmware from u-boot md.d |
| Title | Description |
|---|---|
| Datasheet Database: alldatasheet | Everything's in the title |
| Datasheet Database: datasheetcatalog | DatasheetCatalog.com is free an online datasheet source for electronic components and semiconductors from multiple constructors |
| Datasheet Database: datasheets | Datasheets on electronic components |
| Title | Description |
|---|---|
| Online Circuit emulator | Electronic circuit Emulator |
| IC logo Database | Everything's in the title |
| An Affordable And Programmable PLC Hackaday | A review of an alternative of a PLC |
| TechInfoDepot Wiki | Wiki about ICS, but it's not wikipedia |
| FCC ID Search | Search engine for FCC ID database, useful for identifying wireless modules and radio equipment in ICS/IoT devices. |
| Title | Description |
|---|---|
| Reverse of a cisco hwic 3g cdma | |
| Rop chain pre-hauth on security camera | as the title said a masterclass |
| Flock security camera audit | audit covering the scandalous state of flock security camera |
| Title | Description |
|---|---|
| ICP DAS WP-8821-CE7 Manuals | User manuals and documentation for the ICP DAS WP-8821-CE7 PAC (Programmable Automation Controller). |
| Title | Description |
|---|---|
| ICS Training Calendar CISA | Basically the training calendar of the CISA |
| ICS 301v Review · Aaron Hoffmann | A free online course on ICS 301v made by Aaron Hoffmann |
| HOME Dean Parsons | The home page of Dean Parsons, a major ICS expert, instructor & defender |
| Assessing and exploiting control systems IIOT | Free e-learning tutorial on SCADA security |
| Global Industrial Cyber Security Professional (GICSP) | GICSP home page for this certification |
| ICS Cyber conference | Some conference for ICS |
| ISA secure certifications program | The ISASecure program delivers OT cybersecurity certifications. |
| Industrial Control System Cyber Security Institute | Industrial Control System Cyber Security Institute training page |
| ENISA Online Training - Network Forensics | ENISA free online training material for cybersecurity specialists, including network forensics exercises applicable to ICS environments. |
| ISA/IEC 62443 Training Course (IC32M) | ISA official training course on using the ISA/IEC 62443 standards to secure industrial automation and control systems. |
| Title | Description |
|---|---|
| OPC UA Security Analysis | OPC UA Security Analysis from the German Governement |
| CWE VIEW: Weaknesses Addressed by ISA/IEC 62443 Requirements | This view (slice) covers weaknesses that are addressed by following requirements in the ISA/IEC 62443 series of standards for industrial automation and control systems (IACS). Members of the CWE ICS/OT SIG analyzed a set of CWEs and mapped them to specific requirements covered by ISA/IEC 62443. |
| NERC Reliability Standards | NERC Reliability Standards are developed using an industry-driven, process that ensures the process is open to all persons who are directly and materially affected by the reliability of the North American bulk power system; |
| Title | Description |
|---|---|
| IRG on Water sector | Incident Response Guide Water and Wastewater Sector |
| IACS System Testing and Assessment Rating Score Calculator | A method on how to assess and rate a vulnerability |
| (Risk Management) EBIOS RM Method | The french way of assess the risk, with its 2018 version. You like it ? It's french. |
| French Business Continuity Plan Guide (PCA) | Official French government guide for business continuity planning (Plan de Continuité d'Activité) from SGDSN. |
| Title | Description |
|---|---|
| DOD requirement propositions | DEPARTMENT OF DEFENSE CONTROL SYSTEMS SECURITY REQUIREMENTS GUIDE |
| NIST Special Publication SP 800-82r3 Guide to Operational Technology Security | Fundamental requirement for anybody who wants to start a OT security program |
| Saudi Arabia Operatinos Technology Cyber Control | Saudi Arabia versions of implementations of different requirement |
| Title | Description |
|---|---|
| NIS directive in eatch EU country | specifications and informations about implementations of the NIS directiv in eatch EU country |
| The NIST Cybersecurity Framework (CSF) 2.0 | The NIST Cybersecurity Framework (CSF) 2.0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks. It offers a taxonomy of high- level cybersecurity outcomes that can be used by any organization — regardless of its size, sector, or maturity — to better understand, assess, prioritize, and communicate its cybersecurity efforts. |
| (UK) Control Of Major Accident Hazards Regulations 2015 (COMAH) | Everything's in the title |
| CISA on CIRCIA | In March 2022, President Biden signed into law the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). Enactment of CIRCIA marked an important milestone in improving America's cybersecurity by, among other things, requiring the Cybersecurity and Infrastructure Security Agency (CISA) to develop and implement regulations requiring covered entities to report covered cyber incidents and ransomware payments to CISA. |
| NIS 2 Directive Articles | Full text of the NIS 2 Directive articles, the updated EU framework for cybersecurity of critical infrastructure including OT/ICS systems. |
| Title | Description |
|---|---|
| ISA Global Cyber Alliance | The main page of the ISA Global Cybersecurity Alliance (ISAGCA), a global consortium working to secure critical infrastructure |
| Institute of Electrical and Electronics Engineers | not full ICS oriented , but one of the biggest organisations in the electrical and electronics engeniering field |
| The ICS Advisory Project | The ICS Advisory Project is an open-source project to provide DHS CISA ICS Advisories data in Comma Separated Value (CSV) format to support vulnerability analysis for the ICS/OT community. |
| ENISA website | European Union Agency for cybersecurity |
| ETHOS - Emerging Threat Open Sharing | Open-source platform for sharing emerging threat information across the OT/ICS security community in near real-time. |
| Enabling Collective Defense with ETHOS - Claroty | Claroty article explaining the ETHOS initiative and how it enables collective defense against OT cyber threats. |
| Scadalliance | Alliance of SCADA/ICS cybersecurity stakeholders fostering collaboration and knowledge sharing in the OT security space. |
| Title | Description |
|---|---|
| STORMSHIELD-SNi40-Datasheet | Stormshield monitoring & security solution for industries |
| Checkpoint 1570R-rugged-security-gateway-datasheet | The Check Point NGFW description sheet |
| Nozomie Saas tours | Tour of the security platform of nozomie |
| FortiDeceptor Datasheet | Fortinet FortiDeceptor deception technology datasheet, applicable to OT/ICS environments for detecting lateral movement and reconnaissance. |
| Nozomi Networks Platform Overview PDF | Detailed overview document of the Nozomi Networks OT/IoT visibility and security platform. |
| Title | Description |
|---|---|
| Nozomi Network Solutions | The home page of Nozomi's Threat Detection & Response for Critical Infrastructure & Industrial Security Teams |
| SIGASEC | A collection of monitoring solutions for OT network |
| Leroy Automation | French PLC manufacturer |
| waterfall security | |
| Owlcyberdefence | data diode provider |
| Custocy | they do OT stuff |
| OTORIO | OT security solutions and exposure management vendor specializing in risk assessment and attack surface management for industrial environments. |
| OTbase - OT Asset Management | OT asset management software for discovering, tracking and managing operational technology assets across industrial networks. |
| Title | Description |
|---|---|
| Microsoft ICS Forensic Tools | Microsoft opensource ICS forensic tools |
| Claroty team 82 forensic plogpost on unitronix PLC | From Exploits to Forensics: Unraveling the Unitronics Attack |
| Title | Description |
|---|---|
| Malcolm ICS | Malcolm is a powerful network traffic analysis maintained and updated by CISA and the Idaho National Laboratory (INL) |
| Documentation for Malcolm ICS | Documentation for Malcolm ICS |
| Network Traffic Analysis with Malcolm - INL PDF | Idaho National Laboratory presentation on using Malcolm for ICS network traffic analysis and threat detection. |
| Title | Description |
|---|---|
| Suricata rules for ICS detections | A collection of Suricata rules for ICS detections (Unitronics & Zyxel) |
| Standard rules for custom protocols | Standard rules for custom protocols like DNP3, ENIP, and Modbus |
| Suricata rules for Nmap detections | Suricata rules for detecting Nmap fingerprinting packets sent for ICS protocols |
| Snort rules for exploit detections | NSA-backed repository for exploit detection in ICS environments |
| Title | Description |
|---|---|
| BLE Security Research Paper | Academic paper on Bluetooth Low Energy security analysis relevant to ICS/IoT wireless communications. |
| Quick Introduction to gatttool for BLE Data Access | Practical tutorial on using gatttool to interact with Bluetooth Low Energy devices, applicable to IoT/ICS device testing. |
| Title | Description |
|---|---|
| IoT Security - Zigbee Protocol 101 - Payatu | Introduction to Zigbee protocol security fundamentals in the context of IoT security assessment. |
| Don't Kick Over the Beehive: Attacks and Security Analysis on Zigbee (CCS 2022) | Academic paper from CCS 2022 analyzing attacks and security weaknesses in the Zigbee protocol. |
| Zigbee Cluster Library Specification | Official Zigbee Cluster Library specification document for understanding Zigbee application-layer communication. |
| Zigbee Protocol Security Assessment - Kaspersky Securelist | Kaspersky's in-depth security assessment of the Zigbee protocol covering vulnerabilities and attack vectors. |
| Sniffing Philips Hue Zigbee Traffic with Wireshark | Practical guide on capturing and analyzing Zigbee traffic from Philips Hue smart lighting using Wireshark. |
| Sécurité de Zigbee (FR) | French educational resource on Zigbee protocol security analysis. |
| Analyzing Zigbee Security via SDR | Research paper on analyzing Zigbee communication security in smart environments using Software Defined Radio. |
| Title | Description |
|---|---|
| PLC Hacking (Pt. 1) Redfox Security | [Down for the moment] A tutorial on PLC hacking |
| Let's Call It a Day — Virtual SCADA Hacking with GRFICSv2 Part 1 | A tutorial on how to exploit built-in ICS functionality to shut down a virtual plant simulator |
| Going Out With a Bang — Virtual SCADA Hacking with GRFICSv2 Part 2 | Well, it's the 2nd part of the article below |
| Fortiphyd Logic - YouTube | A gold mine of a youtube channel about built solutions for security and operations in IT and OT |
| ControlThings.io - Tools | A collection of tools for OT/ICS pentesting made by ControlThings |
| Bypassing Authentication in Schneider Electric PLCs (M340/M580) | Examining Crypto and Bypassing Authentication in Schneider Electric PLCs (M340/M580) |
| Schneider eletric Exploit PoC | Modicon M580/M340 Safety Protection bypass and utils. |
| FuzzySully | FuzzySully is an OPC UA fuzzer built upon Fuzzowski. It is a specialized testing tool designed to identify vulnerabilities and bugs in OPC UA implementations. The fuzzer operates by generating and sending a large number of malformed or unexpected messages to an OPC UA server or client, with the goal of triggering unexpected behavior or crashes. |
| Compromising Critical Infrastructure by Reversing SCADA Software | |
| MITRE Caldera for OT | MITRE Caldera OT plugins and capabilities for adversary emulation and red team operations in ICS/OT environments. |
| Schneider UMAS TALOS Vulnerability | Talos vulnerability disclosure for Schneider Electric Modicon M580 UMAS Read Memory Block out-of-bounds read. |